playing with Charles ssl proxy

[Swamppifi]

Hi all

I have spent the weekend setting up a Charles proxy to intercept and decode SSL traffic on my computer

see image of my login interception. on yes it did intercept the correct login detail while encrypted

I can see some potential with a pineapple, captive portal . the rubberduck, and charles

for charles to work, it must have its own certificate in the trusted store, hence captive portal and rubber duck as mean of placing the certificate.

I will play with this some more over the next few weekends,

experiments ongoing..

[cooper]

Where does the duck come into play in this? Automating the addition to the truststore?

[Swamppifi]

Hi Cooper

Yes, the duck would be help install the certificate, put it on github or some other file hosting site and call down by the tinyurl web site, then using the CMD and MMC, i need to work out the key strokes to do it, need to sit down and play with it.

the captive portal would do the same as well, install the certificate into both truststores.

will keep posting as I work things out.

[Swamppifi]

I have played with charles some more this weekend, After I flashed my Pineapple with the latest firmware, I turned it on while loading some infusions.

It captured all SLL traffic while installing the infusion, see photo of the capture.

it passed the pinapple traffic.

but when I connected another laptop to the pineapple and browsed the internet, i could browse, but the fraffic wasn't captured.

Still more playing needed, I will need to configure the connecting computer to connect to the proxy's IP and port

Edited August 10, 2014 by Swamppifi

[Hell0w0rld]

charles support more protocal...like swf..

you can download its cert into pc